The Address Resolution Protocol (ARP) is a protocol that communicates with hardware interfaces on the data link layer and provides services for the upper layer.
IP packets are often transmitted over the Ethernet. Ethernet devices cannot identify 32-bit IP addresses. They transmit Ethernet packets using 48-bit Ethernet addresses. Therefore, the destination IP address must be translated into an Ethernet destination address.
On an Ethernet, a host must know the MAC address of the peer host when communicating with that host. How is the destination MAC address obtained? It is obtained through the ARP. The ARP is used to resolve an Internet IP address into an Ethernet hardware address (MAC address) to ensure the smooth communication.
Position of ARP in the TCP/IP protocol
ARP packet format
Fields in an ARP packet
Hardware type: indicates the type of the hardware interface that the sender wants to know. The value for Ethernet is 1.
Protocol type: indicates the upper-layer protocol provided by the sender. The value for IP is 0800 (hexadecimal).
Hardware length and protocol length: indicate the lengths of the hardware address and the upper-layer protocol address. In this way, the ARP packet can be used in any hardware or any protocol network.
Operation: indicates the type of the packet. The options are as follows: 1: ARP request; 2: ARP reply; 3: RARP request; 4: RARP reply.
Sender hardware address (0-3 bytes): indicates the first four bytes in the hardware address of the source host.
Sender hardware address (4-5 bytes): indicates the last two bytes in the hardware address of the source host.
Sender protocol address (0-1 bytes): indicates the first two bytes in the hardware address of the source host.
Sender hardware address (2-3 bytes): indicates the last two bytes in the hardware address of the source host.
Target hardware address (0-1 bytes): indicates the first two bytes in the hardware address of the destination host.
Target hardware address (2-5 bytes): indicates the last four bytes in the hardware address of the destination host.
Target protocol address (0-3 bytes): indicates the IP address of the destination host.
Working principle of ARP
Each host creates an ARP table in its ARP cache to indicate the mapping between IP addresses and MAC addresses.
When the source host needs to send a data packet to the destination host, the source host first checks whether the MAC address corresponding to the destination IP address exists in its ARP table. If yes, the source host directly sends the data packet to the MAC address. If no, the source host sends a broadcast ARP request to the local network segment to query the MAC address of the destination host. The ARP request contains the IP address and hardware address of the source host and IP address of the destination host.
After receiving the ARP request, all hosts on the local network check whether the destination IP address in the message is the same as its own IP address. If they are different, the data packet is ignored. If they are the same, the host adds the MAC address and IP address of the source host to its ARP table. If the IP address already exists in the ARP table, the host overwrites the original data and sends an ARP reply.
After receiving the ARP reply, the source host adds the IP address and MAC address of the destination host to its ARP table and starts data transmission. If the source host does not receive any ARP reply, the ARP query fails.
Gratuitous ARP for duplicate IP address detection
ARP can be used to detect duplicate IP addresses by transmitting a gratuitous ARP request. A gratuitous ARP request is generally broadcast as an ARP request in which the sender's protocol address (SPA) and target's protocol address (TPA) are set to the same IP address.
If a host broadcasts an ARP request in which the destination address is its own IP address, the host should not receive any ARP reply from other hosts. In this way, the host can determine that no other host uses the same IP address. If the host receives an ARP reply from another host, the two hosts use the same IP address.
If a host does not receive any ARP reply after sending three gratuitous ARP requests, the IP address of the host is regarded to be unique in the network segment.
